!441 fix CVE-2022-4141 and delete irrelevant log file
From: @wangjiang37 Reviewed-by: @lvying6 Signed-off-by: @lvying6
This commit is contained in:
openeuler-ci-bot
Gitee
commit
0f912bbf7e
145
backport-CVE-2022-4141.patch
Normal file
145
backport-CVE-2022-4141.patch
Normal file
@ -0,0 +1,145 @@
|
||||
From cc762a48d42b579fb7bdec2c614636b830342dd5 Mon Sep 17 00:00:00 2001
|
||||
From: Bram Moolenaar <Bram@vim.org>
|
||||
Date: Fri, 25 Nov 2022 13:03:31 +0000
|
||||
Subject: [PATCH] patch 9.0.0947: invalid memory access in substitute with
|
||||
function
|
||||
|
||||
Problem: Invalid memory access in substitute with function that goes to
|
||||
another file.
|
||||
Solution: Check for text locked in CTRL-W gf.
|
||||
---
|
||||
src/normal.c | 33 ++++++++++++++++++++++++---------
|
||||
src/proto/normal.pro | 1 +
|
||||
src/testdir/test_substitute.vim | 19 +++++++++++++++++++
|
||||
src/window.c | 4 +++-
|
||||
4 files changed, 47 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/src/normal.c b/src/normal.c
|
||||
index 938ae718efa2..0d1eba759e69 100644
|
||||
--- a/src/normal.c
|
||||
+++ b/src/normal.c
|
||||
@@ -192,13 +192,33 @@ check_text_locked(oparg_T *oap)
|
||||
{
|
||||
if (text_locked())
|
||||
{
|
||||
- clearopbeep(oap);
|
||||
+ if (oap != NULL)
|
||||
+ clearopbeep(oap);
|
||||
text_locked_msg();
|
||||
return TRUE;
|
||||
}
|
||||
return FALSE;
|
||||
}
|
||||
|
||||
+/*
|
||||
+ * If text is locked, "curbuf_lock" or "allbuf_lock" is set:
|
||||
+ * Give an error message, possibly beep and return TRUE.
|
||||
+ * "oap" may be NULL.
|
||||
+ */
|
||||
+ int
|
||||
+check_text_or_curbuf_locked(oparg_T *oap)
|
||||
+{
|
||||
+ if (check_text_locked(oap))
|
||||
+ return TRUE;
|
||||
+ if (curbuf_locked())
|
||||
+ {
|
||||
+ if (oap != NULL)
|
||||
+ clearop(oap);
|
||||
+ return TRUE;
|
||||
+ }
|
||||
+ return FALSE;
|
||||
+}
|
||||
+
|
||||
/*
|
||||
* Handle the count before a normal command and set cap->count0.
|
||||
*/
|
||||
@@ -816,8 +836,7 @@ normal_cmd(
|
||||
goto normal_end;
|
||||
}
|
||||
|
||||
- if ((nv_cmds[idx].cmd_flags & NV_NCW)
|
||||
- && (check_text_locked(oap) || curbuf_locked()))
|
||||
+ if ((nv_cmds[idx].cmd_flags & NV_NCW) && check_text_or_curbuf_locked(oap))
|
||||
// this command is not allowed now
|
||||
goto normal_end;
|
||||
|
||||
@@ -4058,13 +4077,9 @@ nv_gotofile(cmdarg_T *cap)
|
||||
char_u *ptr;
|
||||
linenr_T lnum = -1;
|
||||
|
||||
- if (check_text_locked(cap->oap))
|
||||
- return;
|
||||
- if (curbuf_locked())
|
||||
- {
|
||||
- clearop(cap->oap);
|
||||
+ if (check_text_or_curbuf_locked(cap->oap))
|
||||
return;
|
||||
- }
|
||||
+
|
||||
#ifdef FEAT_PROP_POPUP
|
||||
if (ERROR_IF_TERM_POPUP_WINDOW)
|
||||
return;
|
||||
diff --git a/src/proto/normal.pro b/src/proto/normal.pro
|
||||
index 106d0e1..eff08df 100644
|
||||
--- a/src/proto/normal.pro
|
||||
+++ b/src/proto/normal.pro
|
||||
@@ -1,4 +1,5 @@
|
||||
/* normal.c */
|
||||
+int check_text_or_curbuf_locked(oparg_T *oap);
|
||||
void normal_cmd(oparg_T *oap, int toplevel);
|
||||
void check_visual_highlight(void);
|
||||
void end_visual_mode(void);
|
||||
diff --git a/src/testdir/test_substitute.vim b/src/testdir/test_substitute.vim
|
||||
index 7e7ccff..73c8c57 100644
|
||||
--- a/src/testdir/test_substitute.vim
|
||||
+++ b/src/testdir/test_substitute.vim
|
||||
@@ -1076,6 +1076,25 @@ func Test_sub_edit_scriptfile()
|
||||
bwipe!
|
||||
endfunc
|
||||
|
||||
+" This was editing another file from the expression.
|
||||
+func Test_sub_expr_goto_other_file()
|
||||
+ call writefile([''], 'Xfileone', 'D')
|
||||
+ enew!
|
||||
+ call setline(1, ['a', 'b', 'c', 'd',
|
||||
+ \ 'Xfileone zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz'])
|
||||
+
|
||||
+ func g:SplitGotoFile()
|
||||
+ exe "sil! norm 0\<C-W>gf"
|
||||
+ return ''
|
||||
+ endfunc
|
||||
+
|
||||
+ $
|
||||
+ s/\%')/\=g:SplitGotoFile()
|
||||
+
|
||||
+ delfunc g:SplitGotoFile
|
||||
+ bwipe!
|
||||
+endfunc
|
||||
+
|
||||
" Test for the 2-letter and 3-letter :substitute commands
|
||||
func Test_substitute_short_cmd()
|
||||
new
|
||||
diff --git a/src/window.c b/src/window.c
|
||||
index 97cc77035f95..a2bebcaea4df 100644
|
||||
--- a/src/window.c
|
||||
+++ b/src/window.c
|
||||
@@ -534,6 +534,8 @@ do_window(
|
||||
case Ctrl_F:
|
||||
wingotofile:
|
||||
CHECK_CMDWIN;
|
||||
+ if (check_text_or_curbuf_locked(NULL))
|
||||
+ break;
|
||||
|
||||
ptr = grab_file_name(Prenum1, &lnum);
|
||||
if (ptr != NULL)
|
||||
@@ -857,7 +859,7 @@ win_split(int size, int flags)
|
||||
* When "new_wp" is NULL: split the current window in two.
|
||||
* When "new_wp" is not NULL: insert this window at the far
|
||||
* top/left/right/bottom.
|
||||
- * return FAIL for failure, OK otherwise
|
||||
+ * Return FAIL for failure, OK otherwise.
|
||||
*/
|
||||
int
|
||||
win_split_ins(
|
||||
--
|
||||
2.33.0
|
||||
9
vim.spec
9
vim.spec
@ -12,7 +12,7 @@
|
||||
Name: vim
|
||||
Epoch: 2
|
||||
Version: 9.0
|
||||
Release: 2
|
||||
Release: 3
|
||||
Summary: Vim is a highly configurable text editor for efficiently creating and changing any kind of text.
|
||||
License: Vim and MIT
|
||||
URL: http://www.vim.org
|
||||
@ -73,6 +73,7 @@ Patch6043: backport-CVE-2022-3297.patch
|
||||
Patch6044: backport-9.0.0581-adding-a-character-for-incsearch-fails-at-end-of-line.patch
|
||||
Patch6045: backport-CVE-2022-3324.patch
|
||||
Patch6046: backport-CVE-2022-3705.patch
|
||||
Patch6047: backport-CVE-2022-4141.patch
|
||||
|
||||
Patch9000: bugfix-rm-modify-info-version.patch
|
||||
Patch9001: vim-Add-sw64-architecture.patch
|
||||
@ -473,6 +474,12 @@ LC_ALL=en_US.UTF-8 make -j1 test
|
||||
%{_mandir}/man1/evim.*
|
||||
|
||||
%changelog
|
||||
* Mon Nov 28 2022 wangjiang <wangjiang37@h-partners.com> - 2:9.0-3
|
||||
- Type:CVE
|
||||
- ID:CVE-2022-4141
|
||||
- SUG:NA
|
||||
- DESC:fix CVE-2022-4141 and delete irrelevant log file
|
||||
|
||||
* Thu Nov 10 2022 wuzx<wuzx1226@qq.com> - 2:9.0-2
|
||||
- Type:feature
|
||||
- CVE:NA
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user